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ABSTRACT 

This report is the result of an audit of selected 
financial management practices of the State University of New York 
(SUNY) at Albany for the period April 1, 1992 through July 31, 1994. 
The audit addressed the following practices: cash, payroll, 
purchasing, revenue accounting, accounts receivable, and computer 
contingency plans. The report concludes that SUNY Albany has, in 
general, established effective controls over its resources. 
Improvement opportunities are, however, identified in the following 
areas: payroll changes to ensure that paychecks are not generated 
erroneorsly; purchasing practices; cash controls; and computer center 
contingency planning. Comments by SUNY officials generally concur 
with most of the report recommendations. After an introduction 
summarizing the audit's findings, a section is dedicated to each of 
the major areas investigated. Appendices list major contributors to 
the report and present the comments of SUNY officials. (OB) 
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State of New York 

Office of the State Comptroller 



Division of Management Audit 

Report 94-S-85 

Mr. Thomas A. Bartlett, Ph.D. 
Chancellor 

State University of New York 
State University Plaza 
Albany, NY 12246 

Dear Dr. Bartlett: 

The following is our audit report on selected financial management 
practices of the State University of New York at Albany. 

This audit was performed pursuant to the State Comptroller's authority 
as set form in Section 1. Article V of the State Constitution and Section 
8, Article 2 of the State Finance Law. Major contributors to this report 
are listed in Appendix A. 
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Executive Summary 



State University of New York at Albany 
Financial Management Practices 



The State University of New York at Albany (SUNY Albany) is one of 
four university centers in the State University of New York (SUNY) 
system. SUNY Albany has more than 17,000 students, receiving about 
$40 million annually in tuition. For the 1993-94 fiscal year, State 
appropriations in support of SUNY Albany operations totaled over $94 
million. 

We audited selected financial management practices of SUNY Albany for 
the period April 1, 1992 through July 31, 1994. Our audit addressed the 
following question relative to SUNY Albany's cash, payroll, purchasing, 
revenue accounting, and accounts receivable practices and its computer 
contingency plans: 

• Has SUNY Albany established appropriate controls over its resources 
to ensure that assets are properly safeguarded and that transactions are 
appropriate? 



Audit Observations we found that SUNY Albany has, in general, established effective 
and Conclusions controls over its resources. However, we have identified improvement 

opportunities in several areas. For example, we found that SUNY 
Albany needs to improve controls over payroll changes to ensure that 
paychecks are not generated erroneously. For the first two months of 
1994, SUNY Albany returned 38 paychecks worth over $15,000 to the 
Office of the State Comptroller (OSC) as a result of paychecks issued in 
error. We identified two individuals who received and cashed such 
unearned paychecks. We also found mat SUNY Albany's system for 
monitoring and controlling inappropriate use of sick leave credits is not 
as effective as it ought to be, and that improvements could be made in 
the monitoring and approval of overtime, (see pp. 3-5) 

We determined that SUNY Albany's purchasing practices are generally 
in compliance with its guidelines, but that controls could be strengthened 
in some areas. For example, SUNY Albany could improve its purchas- 
ing practices by requiring that, when practical to do so, purchased items 
be delivered to the central receiving dock and counted to independently 
verify the amount delivered. We also identified control weaknesses in 
SUNY Albany's use of the Quick Pay Vouchering System. OSC 
provides the Quick Pay System to State agencies to allow them to 



Scope of Audit 
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process invoices more efficiently. SUNY can currently use Quick Pay 
to process vouchers of $1,000 or less. However, we found that SUNY 
Albany's primary Quick Pay certifier is nlso authorized to enter voucher 
data, contrary to the Office of the State Comptroller's guidelines related 
to separating Quick Pay's critical functions, (see pp. 7-9) 

We also noted that SUNY Albany could improve its cash controls for 
peripheral cash collection locations, cash advance accounts and Income 
Fund Reimbursable (IFR) accounts. We found that appropriate controls 
are not followed at certain remote cash collection locations and that 
certain IFR account managers do not comply with the IFR procedures 
manual. Further, we found that SUNY Albany does not deposit the 
proceeds of checks outstanding over three years into the State's General 
Fund, as required by the State Finance Law. Instead, SUNY Albany 
follows SUNY's policy of depositing these funds in a SUNY income 
fund. As a result, over $15,000 was inappropriately deposited in a 
SUNY income fund, (see pp. 11-14) 

Lastly, we determined that SUNY Albany could further improve its 
computer center contingency plan by identifying critical applications and 
periodically testing the contingency plan, (see pp. 15-16) 



SUNY officials concur with most of our report recommendations and 
indicate that steps are being taken to implement them. They do not 
consider it fiscally feasible or efficient to require that purchases be 
delivered to a central receiving point for an independent verification of 
the amount delivered. Officials believe that the receiving procedures that 
are currently in place are adequate. 



Comments of 
SUNY Officials 
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Introduction 



Background The State University of New York at Albany (SUNY Albany), estab- 

lished in 1844, is one of four university centers in the State University 
of New York (SUNY) system and the oldest of the SUNY colleges and 
universities. The main campus, opened in 1966, is situated on 382 acres 
on the west side of the City of Albany. SUNY Albany also maintains 
a campus in downtown Albany containing academic facilities, residence 
halls, offices and a library. 

For the 22-month period ended January 31, 1994* SUNY Albany had 
total expenditures of $247.8 million, $163.7 million of which was for 
personal service expenditures for about 2,970 employees. SUNY Albany 
has more than 17,000 students and receives about $40 million annually 
in tuition. State appropriations for SUNY Albany operations for the 
1993-94 fiscal year totaled over $94 million. 



We audited selected SUNY Albany financial management practices for 
the period April 1, 1992 through July 31, 1994. The objective of our 
performance audit was to evaluate the adequacy of the internal control 
structure and the propriety of transactions related to cash receipts and 
disbursements, payroll, purchasing, revenue accounting (including student 
accounts), accounts receivable, computer contingency plans, equipment 
inventory and auxiliary service corporation food purchases. To accom- 
plish this objective, we reviewed SUNY Albany's policies and proce- 
dures, reviewed applicable rules and regulations, interviewed SUNY 
Albany management and staff, and reviewed appropriate documentation. 
We found no significant control weaknesses over student accounts, 
equipment inventory and auxiliary service corporation food purchases. 

We conducted our audit in accordance with generally accepted govern- 
ment auditing standards. Such standards require that we plan and 
perform our audit to adequately assess those operations of SUNY Albany 
which are included in our audit scope. These standards also require that 
we understand SUNY Albany's internal control structure and its 
compliance with those laws, rules and regulations that are relevant to 
SUNY Albany's operations included in our audit scope. An audit 
includes examining, on a test basis, evidence supporting transactions 
recorded in the accounting and operating records; and applying such 
other auditing procedures as we consider necessary in the circumstances. 



Audit Scope, 
Objectives and 
Methodology 
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An audit also includes assessing the estimates, judgments and decisions 
made by management. We believe that our audit provides a reasonable 
basis for our findings, conclusions and recommendations. 

We use a risk-based approach when selecting activities to be audited. 
This approach focuses our audit efforts on those operations that have 
been identified through a preliminary survey as having the greatest 
probability for needing improvement. Consequently, by design, finite 
audit resources are used to identify where and how improvements can be 
made. Thus, little audit effort is devoted to reviewing operations that 
may be relatively efficient or effective. As a result, our audit reports 
are prepared on an "exception basis." This report, therefore, highlights 
those areas needing improvement and does not address activities that may 
be functioning properly. 



Response of SUNY 
Officials to Audit 



A draft copy of this report was provided to SUNY officials for their 
review and comment. Their comments have been considered in 
preparing this report and are included as Appendix B. 

In addition to the matters covered in this report, we have provided 
SUNY officials with detailed comments and recommendations concerning 
other SUNY Albany financial practices. Although these matters are of 
lesser significance, the recommendations should be implemented to 
improve controls. 

Within 90 days after final release of this report, as required by Section 
170 of the Executive Law, the Chancellor of the State University shall 
report to the Governor, the State Comptroller, and the leaders of the 
Legislature and fiscal committees, advising what steps were taken to 
implement the recommendations contained herein and where recommenda- 
tions were not implemented, the reasons therefor. 
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Payroll and Personnel Issues 



Our review of SUNY Albany's payroll and personnel procedures showed 
that SUNY Albany needs to improve controls over payroll changes to 
ensure that paychecks are not generated erroneously. SUNY Albany 
should also implement a more effective sick leave monitoring system, 
and more closely control overtime expenses. 



Payroll Changes Payroll change documents must be processed timely to ensure that 

employees are paid only for time worked. SUNY Albany relies upon 
each department to notify the Personnel Department of any changes in 
employee status that require payroll changes. In our prior audit of 
SUNY Albany (Report 89-S-59, issued in June 1990), we recommended 
that SUNY Albany improve its procedures to ensure that paychecks were 
generated only for individuals entitled to them. We found that SUNY 
Albany has improved controls over payroll changes for adding employees 
to the payroll, but needs to further improve controls to ensure the timely 
removal from the payroll of those who leave SUNY Albany employment. 

We found that SUNY Albany inappropriately generated paychecks for 
individuals who were no longer employed by SUNY Albany. During the 
first two months of 1994, SUNY Albany returned to the Office of the 
State Comptroller (OSC) a total of 38 paychecks worth over $15,000 that 
had been issued in error to employees on the Main and Graduate/Teacher 
Assistant payrolls. This happened because SUNY Albany did not notify 
OSC of the employees' removal from the payroll in time to. prevent the 
issuance of the paychecks. Most of the erroneously issued paychecks 
were only for the pay period immediately following the employees' last 
day of work. However, for three individuals, paychecks were generated 
for two or more consecutive pay periods. Further, we found that two 
individuals had received and cashed unearned paychecks. As a result of 
our review, SUNY Albany has recovered the $969 in excess payments 
made to these individuals. 



Since 1982, State agencies have been required to develop and adopt a 
comprehensive program to reduce and control inappropriate use of sick 
leave credits. In our prior audit, we recommended that SUNY Albany 
design and implement a system to monitor and control sick leave use and 
abuse. In March 1994, SUNY Albany began implementing a formal sick 
leave monitoring system to replace its informal monitoring system. 
However, improvements could be made in the recently established formal 
system to better monitor sick leave use. 



Sick Leave 
Monitoring 



SUNY Albany's formal sick leave monitoring system generates reports 
which indicate the amount of sick leave used by each employee during 
the past year. However, the system does not define what constitutes 
potentially excessive sick leave use, or identify those employees who 
have used significant amounts of sick leave. In addition, the system 
does not indicate the dates that employees used sick leave. Therefore, 
supervisors cannot use the system to readily identify data indicating sick 
leave abuse, such as taking sick leave before or after weekends or 
holidays. 

To estimate the extent of potential sick leave abuse, we determined the 
maximum potential balance of sick leave credits for all of SUNY 
Albany's 2,970 employees as of March 31, 1994. We found that about 
400 employees (13 percent) had current sick leave balances which were 
less than 25 percent of their maximum potential balances. We then 
examined the sick leave usage of IS of these employees, and found that 
three exhibited patterns of sick leave usage during 1993 that were 
indicative of abuse. These individuals, who had extremely low sick 
leave balances, had previously been counseled about their use of sick 
leave credits. However, SUNY Albany's monitoring actions do not 
appear to have been effective in curbing their potential abuse of sick 
leave: 

• One employee of 11 years had a sick leave accrual balance of 16 
hours and his excessive sick leave use was noted on his December 1992 
performance evaluation. Yet, this employee continued to use sick leave 
credits during 1993 on days immediately following holidays. 

• The second employee had a sick leave accrual balance of 12 hours 
after ten years of employment, and was cited for excessive sick leave use 
for two consecutive years, but continued to use sick leave credits without 
supporting medical documentation on days immediately preceding or 
following weekends during 1993. 

• The third employee had a sick leave accrual balance of 9.S hours after 
28 years of employment. His excessive use of sick leave credits was 
noted on his September 1990 performance evaluation. However, this 
individual continued to use sick leave credits on days immediately 
preceding or following weekends or holidays on six occasions during 
1993, without supporting medical documentation. 

To ensure adequate monitoring of sick leave use, SUNY Albany should 
obtain more specific sick leave usage information from its monitoring 
system and instruct supervisors to identify and report patterns of potential 
sick leave abuse. 
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Overtime 



Overtime use should be closely monitored to ensure that overtime is 
necessary and that excessive premium costs are not incurred. Generally, 
each SUNY Albany department is responsible for reviewing and 
approving requests for overtime. However, we identified instances of 
overtime payments for work which appears could have been completed 
during normal work hours. For example, one employee was paid 
overtime for washing buses. There was no indication of why overtime 
was needed to complete this work. 

Another employee received $3,775 in overtime payments for painting 
work that could have been completed during his normal work day. This 
employee routinely received overtime payments for this work after being 
absent during normal work hours. A review of the employee's time and 
attendance records showed a pattern of this individual taking Fridays off 
and then working Saturdays, receiving overtime pay for the Saturday 
work. On 9 of 22 such instances, the employee used sick leave credits 
on Friday, and then worked Saturday, receiving overtime pay. As a 
result, SUNY Albany was paying this employee premium wages for 
work which should have been completed during normal work hours. 



Recommendations 

Improve controls over deletions from the payroll so that pay- 
checks are not issued in error. 

Improve the sick leave monitoring system to identify patterns 
of use and implement procedures to curb potential sick leave 
abuse. 

Ensure that all overtime is necessary. 
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Purchasing Practices 



For the 22-month period ended January 31, 1994, SUNY Albany spent 
over $84 million on discretionary purchases, including approximately 
$2.2 million in Quick Pay voucher transactions. SUNY Albany's 
Purchasing Department is responsible for all purchasing transactions 
except for direct payments such as advertising, travel, and utility 
payments, and student stipends, which are processed by the Accounting 
Department. 

We determined that, in general, SUNY Albany's purchasing practices 
comply with its Institutional Services Manual and Purchasing and 
Contracting Procedures and with State Purchasing and Contract Guide- 
lines. However, we found that internal controls for receiving goods need 
improvement to ensure that SUNY Albany receives and pays for only 
authorized purchases. We also identified significant deficiencies in 
internal controls in the Quick Pay Vouchering System concerning the 
separation of critical duties and circumvention of controls over password 
security. 



SUNY Albany could improve procedures to ensure there is an indepen- 
dent verification of the goods received before authorizing payment. 
According to OSC Procurement and Disbursement Guidelines, Bulletin 
No. G-S4, agencies should use a central receiving department, when 
possible. Agencies should also require that someone other than the 
person who made the initial purchase request receive the goods, and 
count and inspect items when received. However, SUNY Albany allows 
departments mat have placed orders for goods to directly receive and 
account for them. We selected a random sample of 13 purchase 
requisitions and examined supporting documentation. Four of the 
purchase orders, worth over $8,500, specified delivery of the goods 
directly to the department that originally ordered the goods, instead of 
delivery to the central receiving dock. These orders were for supplies 
and brochures, both appropriate for delivery to the central receiving 
dock. 

In addition, SUNY Albany's central receiving dock procedures do not 
require the receiving clerks to open, inspect and count all goods 
received. Eight of the purchases we reviewed, worth over $11,000, 
lacked an independent count on the receiving report. The receiving 
department signed and dated the receiving reports, attached the invoices 
and sent them directly to the purchasing department without indicating 
the quantity of items received. 



Receiving Function 
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SUNY officials believe that their current procedures provide a high level 
of assurance that the goods they have paid for have been received as 
ordered and are in good condition. It is ther opinion that the intent of 
the OSC Bulletin is being met. 

We agree that certain items that are technical or sensitive in nature may 
be best delivered to the ordering unit. However, office supplies, general 
supplies, publications, etc. should be handled through a central receiving 
process. As stated in the OSC Bulletin, agencies that do not institute 
proper internal controls over goods received could very well end up 
paying for goods that were never ordered, or for goods of questionable 
quality. If the same person controls the full operation, the stage may be 
set for collusive arrangements. 



Quick Pay OSC provides for voucher payment using the Quick Pay Vouchering 

Transactions System to allow State agencies to process invoices more efficiently. 

SUNY campuses can use Quick Pay to process invoices for $1,000 or 
less. With Quick Pay, SUNY campuses first enter vouchers on the 
SUNY Central Accounting System. After that, campus staff access the 
OSC computer through a means of electronic transfer, referred to as 
Gateway, to transmit the voucher data to the State Accounting System. 
Designated campus staff can then access the Quick Pay System to certify 
the vouchers for payment. OSC then pays the vendor, sometimes as 
soon as the next day. 

We found that SUNY Albany has not established adequate controls over 
access to Quick Pay. For example, OSC Accounting Bulletins state that 
individuals who perform data entry for Quick Pay transactions cannot 
also certify Quick Pay transactions. However, we found that SUNY 
Albany's primary Quick Pay certifier is also authorized to enter Quick 
Pay transactions. Therefore, the potential exists for this individual to 
certify inappropriate payments. 

SUNY Albany should also comply with procedures over the security of 
Quick Pay password access. Quick Pay Policies for Security concerning 
password controls state that any password that is not used for 30 days 
will expire in another 30 days unless changed by the user. This control 
is designed to help prevent unauthorized access. However, we found 
that on one occasion, SUNY Albany officials requested an employee, 
who was out on extended leave, to certify 16 transactions worth about 
$6,000. Officials stated that they did this to ensure the certified 
password did not expire. However, OSC's Security Unit told us that the 
process of renewing an expired password requires only about five 
minutes. 
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While all the above transactions appeared reasonable, SUNY Albany- 
should consistently follow OSC security procedures to reduce the risk of 
unauthorized access to the Quick Pay system. 



Recommendations 

4. Provide for the independent verification and count of all 
merchandise delivered to the campus. 

5. Adopt management controls to ensure adequate separation of 
duties for the Quick Pay Vouchering System. 

6. Deactivate Quick Pay passwords for employees who are out 
on extended leave. 
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Cash Controls 



We noted that control improvements could be made over cash collected 
at remote locations, advance accounts, and Income Fund Reimbursable 
(IFR) accounts established by SUNY Albany. 



Cash Collections SUNY Albany generally receives all cash payments through the Bursar's 

Office, but also has 24 remote locations which receive approximately 
$1.8 million in cash annually. A recently completed audit of internal 
controls over cash collections at remote locations of selected SUNY 
campuses, which included SUNY Albany (Report 94-S-27, issued in 
August 1994), reported that certain fundamental controls, such as 
adequate separation of duties and use of restrictive endorsements on 
checks, were not in place at some of the remote locations. 

We reviewed the controls in place over cash collections at three SUNY 
Albany remote locations: the Office of Bus Services (Bus Services), the 
Registrar's Office and the Psychological Service Center (Center). Since 
we had visited two of these sites (Bus Services and the Registrar's 
Office) during the recent audit, we also determined whether SUNY 
Albany had taken steps to implement the recommendations contained in 
that report. 

We found that SUNY Albany has implemented, or is in the process of 
implementing, the recommendations we made with regard to cash 
controls at the Registrar's Office and Bus Services. However, we also 
found the same kinds of control weaknesses at the Center that our prior 

• lit had found at the Bus Services and Registrar's Office. We believe 
that these weaknesses are likely to exist at the other remote locations that 
have not been audited. To ensure that effective controls are in place at 
all its remote cash collection sites, SUNY Albany should take the 
following actions: establish comprehensive campus-wide guidelines and 
procedures, for the control over cash receipts; determine the extent of 
control weaknesses at each site; and conduct cash counts at these sites 
on a periodic basis to determine whether controls are working as 
intended. 

OSC's Rules and Regulations state that agencies should establish the 
following controls over cash receipts: 

• cash receipts should be promptly recorded and deposited; 

• checks should be endorsed "For Deposit Only" as soon as practical 
after receipt; 
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• receipts should be sequentially issued and accounted for; 

• receipts should be reconciled daily and any discrepancies resolved; 

• receipts should be deposited at least weekly; 

• cash must be adequately protected prior to deposit; and, 

• change funds should be properly accounted for. 

We found that these controls were not in place at the Center, which had 
reported cash receipts totaling over $40,000 during the year ended July 
31, 1993. For example, the Center does not transmit cash collections 
to the Bursar's Office promptly. The cash collected for the period ended 
March 23, 1994 was not sent to the Bursar's Office for deposit until 
April 15th, 22 days after preparing the transmittal form. Likewise, the 
cash collected for the periods ending April 28, 1994 and May 17, 1994 
was not sent to the Bursar's Office for deposit until May 24, 1994, 30 
and 6 days, respectively, after preparing the transmittal form. 

We also found that receipt forms are not adequately accounted for or 
used properly and payments made by check are not adequately processed. 
The Center does not use receipts with a carbon copy and the information 
recorded on the receipt and provided to the customer is not retained by 
the Center. As a result, the receipts cannot be used to verify that all 
amounts are properly recorded as received. Further, receipts are not 
issued sequentially and unused or voided receipts are not properly 
accounted for. We found that receipts were issued from a new receipt 
book before all the receipts from the old book were issued, and that 
some unissued receipts were simply discarded. In addition, checks are 
not restrictively endorsed at the time of receipt, but are endorsed at the 
end of the day or the next day. Further, staff do not verify that checks 
are properly completed by the customer. We noted that the Bursar's 
Office returned a check to the Center because the check was not signed 
by the customer. 

As a result of the above control deficiencies at the Center, SUNY 
Albany has little assurance that all cash is recorded as received and is 
adequately safeguarded and remitted to the Bursar's Office for deposit. 
Although the cash shortages we found were not material, there was no 
indication of any investigation into these discrepancies by SUNY Albany 
staff. 

The Internal Control Act of 1987 requires agencies to establish and 
maintain internal control guidelines for cash collections. We found that 
SUNY Albany has established only very general campus-wide guidelines 
and relies on each remote location to develop more comprehensive 
controls over cash collections. SUNY Albany officials maintain that they 
have complied with the Internal Control Act, since they have established 
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and maintained a system of internal controls and a program of internal 
control review to identify and correct weaknesses. However, we believe 
comprehensive campus-wide cash collection guidelines are necessary, to 
ensure that cash receipts are adequately recorded and safeguarded at all 
remote locations. 



Advance Accounts SUNY Albany maintains four advance accounts with total authorized 

amounts of $135,650. SUNY Albany uses advance accounts to provide 
change, purchase goods which cost less than $250, advance funds to 
employees and for other special purposes. We reviewed the controls in 
place over the four advance accounts and found that, in general, SUNY 
Albany complies with OSC's guidelines and requirements. However, we 
identified the following area where SUNY Albany could improve controls 
over these accounts. 

Section 102 of the State Finance Law requires agencies to transmit to the 
State Treasury, for credit to the General Fund, all unpaid checks that are 
outstanding over three years. We determined that, contrary to the State 
Finance Law, SUNY Albany credits these funds to the SUNY Income 
Fund in accordance with procedures issued by SUNY Central Adminis- 
tration. For example, over $8,000 was deposited in a SUNY Albany 
income fund in March 1994 as a result of stop payment orders placed 
on outstanding checks from three of the advance accounts. Also, over 
$7,700 was deposited in the same fund in June 1993 as a credit from 
outstanding student refund checks. 



IFR Accounts SUNY Albany has 208 Income Fund Reimbursable (IFR) accounts. IFR 

accounts are established by individual SUNY campuses to enable them 
to account for the fees they charge for certain services. The fees 
generated are then used to offset the costs of providing the services. 

We selected a sample of nine IFR accounts to determine if all services 
were appropriately billed and revenues collected. We found that all 
services provided were billed appropriately, but that some improvements 
could be made in collecting revenues. 

SUNY Albany's IFR procedures manual states that when amounts owed 
are unpaid over 30 days, dunning letters should be issued and no further 
services should be given to the customer. However, we found that 
SUNY Albany does not always follow the procedures manual: for two 
of the nine IFR accounts sampled, SUNY Albany did not send dunning 
letters or discontinue services to customers with unpaid amounts over 30 
days. One IFR account had amounts owed since 1982 totaling $37,500 
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and another account had amounts owed for services provided since 1991 
totaling $1,240. 



Recommendations 



7. Develop comprehensive campus-wide written cash control 
guidelines and procedures. 

8. Ensure that remote collection locations establish controls over 
cash receipts in compliance with the Office of the State 
Comptroller's Rules and Regulations. 

9. Ensure that cash controls are adequate at each location which 
receives cash by periodically reviewing controls and proce- 
dures at each location. 

10. Issue dunning letters and discontinue services for IFR 
accounts unpaid over 30 days. 

To SUNY Central: 



11. Advise campus officials to deposit the proceeds of stop 
payment orders placed on checks issued from the advance 
accounts into the State General Fund, as required by the State 
Finance Law. 
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Computer Center Operations 



SONY Albany's Office of Computing and Network Services oversees the 
SUNY Albany Computer Center (Computer Center). The Computer 
Center is responsible for maintaining the IBM Mainframe System 
(Mainframe) that supports a total of 17 administrative systems for end 
users such as faculty, staff and students. Since SUNY Albany's faculty 
and staff use these systems to access data necessary to carry out daily 
functions, these systems must remain available for the continued 
operation of SUNY Albany. Therefore, SUNY Albany should have 
plans for continued computer processing should an event occur that 
damages or destroys computer processing resources. Such plans, called 
contingency plans, provide for an orderly and timely recovery of the 
critical administrative systems in case of a disaster. 

In prior audits reports (Report 84-S-8, issued in 1984 and 86-S-137, 
issued in 1986), we have recommended that SUNY Albany develop a 
written disaster recovery plan that specifies critical processing applica- 
tions and provides for a back-up processing site. In response to these 
recommendations, SUNY Albany developed a "Computer Services Center 
IBM/MVS Disaster Contingency Plan" (Plan) for the Mainframe, 
effective January 14, 1994, which is divided into three sections: risk 
containment, back-up and re-entry. 

We examined the Plan and discussed its contents with SUNY Albany 
officials. We found that, although SUNY Albany has made progress by 
developing a contingency plan, additional improvements could be made. 
One component of a contingency plan is the identification of critical 
applications and how these applications would continue should a disaster 
occur. However, we found that the Plan does not identify those critical 
applications. The Plan simply lists all the Mainframe's administrative 
systems, without distinguishing the critical applications from the less 
important ones. Furthermore, SUNY Albany has only partially tested 
the Plan to determine whether it would be effective if a disaster 
occurred. Conducting tests on a developed plan maximizes recovery 
capability by ensuring that the measures in place will, in fact, function 
as planned. 
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Recommendations 

12. Improve the current contingency plan to provide for an 
orderly and timely recovery of the administrative systems if 
a disaster impacts on computer processing resources. The 
contingency plan should include the identification of critical 
applications. 

13. Fully test the developed contingency plan to ensure that it 
would allow for the recovery of critical computer applica- 
tions. 
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Recommendations (page 5) 

(OSC) 1 . Improve controls over deletions from the payroll so that paychecks are 
not issued in error. 

(SUNYA) 1. The State Comptroller's report states that their previous audit, 
conducted in 1989, recommended improvement in procedures to 
control paychecks. The report notes that we have demonstrated 
improvement in controls over payroll additions. In point of fact, we 
have also demonstrated similar improvement in payroll deletions, 
especially with regular State employees. 

A significant portion of the returned checks cited in this report were for 
Graduate and Teaching Assistants (GA/TA's). As a matter of policy, 
the GA/TA payroll process was dramatically changed since the 
previous audit, and those changes created a condition that lends itself 
to the occasional necessity to return paychecks. Several factors 
contribute to this group of employees being prone to the issuance of 
checks that have to be returned, including: (1) no lag payroll, which is 
much different than the payroll process for all other State employees; 
(2) timing issues that require placement of GA/TA's on the payroll 
before the actual commencement of services; (3) unusual 
circumstances such as students taking ill, with no "sick leave" to cover 
the absence; (4) students with Fall/Spring appointments simply not 
returning to school after the semester break. In almost every other 
case, the issuance of a check in error related to the simple failure of a 
department to notify the Office of Human Resources of an employee 
termination on a timely basis. 

The Campus does view the issuance of paychecks that are not fully 
due and owing to employees as a serious matter. Since the previous 
audit, the Office of Human Resources has issued strongly worded 
bulletins to remind departments of the importance of timely notification 
to that office when employees have resigned, so that appropriate 
action may be taken to remove them from the payroll. Such a 
memorandum will be reissued. In addition, we have worked informally 
on an ad hoc basis with departments who chronically submit late 
paperwork. We will implement a formal procedure that serves to notify 
the department and appropriate administrators when a departmental 
error causes such a condition. 

(OSC) 2. Improve the sick leave monitoring system to identify patterns of use 
and implement procedures to curb potential sick leave abuse. 

(SUNYA) 2. The University acknowledges its responsibility to correct such sick 



leave abuse as exists. In that respect, we will explore the feasibility of: 
(a) modifying our formal, computerized monitoring system to become 
day and date sensitive; and (b) studying the potential of utilizing the 
newly-designed SUNY Central Time Accounting module for this 
purpose. We will also implement follow-up procedures to assure that, 
in cases where counseling and the requirement to provide medical 
documentation have not proven effective in correcting abusive 
behavior, further action is taken. 

Ensure that all overtime is necessary. 

The Office of Human Resources will work with the Budget Office to 
prepare a directive to each Dean, Director and Department Chair 
articulating the need for increased oversight in managing the 
assignment and completion of tasks on an overtime basis. 

(SU) 1-3. We agree with the recommendations and the Campus responses. 

Recommendations (page 8) 

(OSC) 4. Provide for the independent verification and count of all merchandise 
delivered to the campus. 

(SUNYA) 4. We believe there are additional factors to consider associated with the 
University's receiving and payment authorization procedures. 

The report refers to Bulletin G-54 as requiring the campus to establish 
a central receiving function to ensure items are property verified before 
payment is made. We maintain that our current process is consistent 
with Bulletin G-54 in that the Bulletin states that "If possible, you 
should have a central receiving location that is separate..." and "If 
possible, the goods should not be delivered to the person making the 
initial request..." We believe that it is "not possible" for the University 
to use central receiving in a receiving/inspection mode as the auditors 
suggest. The National Association of College and University Business 
Officers College and Universe B usiness Administration Manual 
agrees with the University, citing "In the college or university 
environment, because of the extremely wide range of goods received 
and the sometimes impossibly difficult task of performing quality and/or 
functional inspections on all of them, the 'material forwarding' (central 
receiving) type of receiving function is typically provided.... If the 
receiving function is of the "material forwarding" variety, it is not 
unusual to find situations in which it deducts value, instead of adding 
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(OSC) 3. 
(SUNYA) 3. 



it. For example, overnight or priority parcels can actually be delayed 
by processing. In these cases, because delay has a negative 
customer service value, the institution would do better to require rapid 
delivery services to deliver directly to addresses and bypass central 
receiving. The cost of central receiving in terms of personnel, material- 
handling equipment, and facilities can be high. The cost of receiving 
inspection, because its processes are more complicated and labor- 
intensive, can be much higher. In both cases, the chief financial or 
business officer should make sure that the benefits are in proportion 
to the costs." 

The University does use central receiving processes for a good deal 
of the dollar value of items received by the campus. For example, 
construction type materials and supplies, paper, cleaning, etc., used 
by the plant department are stored in a central warehouse and are 
received centrally by the University. Likewise, all computer equipment- 
-personal computers, printers, etc.-is received through our 
Educational Communications Center, tested, and then delivered to 
departments. Other items-office supplies, general supplies, 
publications, lab supplies-are delivered directly to the departments as 
noted in the audit report. However, for each item received either 
through central receiving or through the individual departments, a 
merchandise received form is submitted by the department to the 
Accounting Department. This form is signed by the individual who 
received the item(s), specifies if the item(s) were received in the 
quantity and style requested on the requisition/purchase order, and 
that the items were received in acceptable condition. The 
merchandise received form serves as acknowledgment that the 
individual signing the form accepts responsibility for accepting those 
goods. 

Because of the audit inquiries, the University reevaluated the use of 
central receiving when developing a response to the initial preliminary 
findings. However, we again concluded that it is not fiscally feasible 
or efficient. The issues noted above were again considered and it was 
estimated that an additional eight FTE would be needed to staff a 
receiving/inspection unit. In addition to the cost of the eight FTE, we 
also saw the increasing number of technical and specific items ordered 
by departments which would not be identifiable by receiving staff, 
delivery delays, and the risk of voiding equipment warranties, as being 
detrimental to University operations. 

We believe that in a complex setting such as the University, direct 
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(SU) 4. 

(OSC) 5. 

(SUNYA) 5. 

(OSC) 6. 



receipt of items by departments is not only unavoidable, but is 
desirable in some cases. We strongly believe the procedures that are 
in place for ordering and certification of items being received as 
ordered and in good condition provide a high level of assurance that 
the goods being paid for are being done so appropriately and that the 
intent of the OSC Bulletin is being met. 

We agree with the Campus response. 

Adopt management controls to ensure adequate separation of duties 
for the Quick Pay Vouchering System. 

Responsibilities have been reassigned within the Accounting office to 
ensure that the person certifying Quick Pay system vouchers has no 
responsibility for entering payment transactions. 

Deactivate Quick Pay passwords for employees who are out on 
extended leave. 



(SUNYA) 6. We agree. — 
(SU) 5,6. We agree with the recommendations and the Campus responses. 
Recommendations (papa 12) 



(OSC) 7. 
(SUNYA) 7. 



Develop comprehensive campus-wide written cash control guidelines 
and procedures. 

A comprehensive Financial Procedures Manual was issued by the 
University in September, 1994. The Manual specifies detailed 
procedures for Income Fund Reimbursable billing and collection, 
project collections, deposit of collections, change funds, return of IFR 
checks, adjustments to billed amounts and reconciliation procedures 
for remote campus collection sites. We believe that the Manual sets 
forth the basic controls for projects to bill and collect. It should be 
noted, however, that because of the various types of activities carried 
out by the campus, it is not possible in one document to specify all 
controls necessary for each of the cash collection areas to use. Each 
area is unique and has special needs regarding how the funds are 
handled to fully ensure adequate protection over the funds. To meet 
this need, the campus pricing study program will be expanded to 
include an evaluation of the billing and collection efforts carried out at 
the IFR program sites to ensure appropriate procedures are in place 
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to provide adequate protection over the assets associated with the 
program. 



Ensure that remote collection locations establish controls over cash 
receipts in compliance with the Office of the State Comptroller's Rules 
and Regulations. 

The combination of the Manual and the expanded pricing program 
should ensure that remote locations have been adequately instructed 
regarding cash billing and collection procedures and policies. 

Ensure that cash controls are adequate at each location which 
receives cash by periodically reviewing controls and procedures at 
each location. 

The expanded pricing program will provide periodic reviews of cash 
controls at locations throughout the campus. Annual budgetary 
reviews and monitoring of deposits by the Collections and Accounting 
Offices will also add to the monitoring of appropriate cash controls. 

Issue dunning letters and discontinue services for IFR accounts unpaid 
over 30 days. 

The Financial Procedures Manual specifies that project directors 
should take appropriate action to follow-up on outstanding receivables 
and not provide further services to clients who have a past due invoice. 
The accounting office will make an extra effort through monitoring of 
outstanding receivables and the expanded pricing project to ensure 
that these guidelines are adhered to by project directors. 

(SU) 7-1 0. We agree with the recommendations and the Campus responses. 

(OSC) 1 1 . Advise campus officials to deposit the proceeds of stop payment 
orders placed on checks issued from the advance accounts into the 
State General Fund, as required by the State Finance Law. 

(SU) 1 1 . The Office of the University Counsel and Vice Chancellor for Legal 
Affairs is reviewing this issue with legal staff of the Office of the State 
Comptroller. 



(OSC) 8. 

(SUNYA) 8. 

(OSC) 9. 

(SUNYA) 9. 

(OSC) 10. 

(SUNYA) 10. 
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Recommendation (page 141 



(SUNYA) 12. 



(OSC) 12. Improve the current contingency plan to provide for an orderly and 
timely recovery of the administrative systems if a disaster impacts on 
computer processing resources. The contingency plan should include 
the identification of critical applications. 

It should be noted that "criticality" is difficult to define. Many of our 
databases, for example, are closely linked and are available to 
different applications of varying critical nature. Perhaps more 
importantly, there is a time-of-year (or time-of semester) effect that is 
distinctive in educational environments. For example, failure of an 
admissions system in early to mid-spring could be disastrous, but 
relatively minor the balance of the year, and similarly for many other 
applications. 

Fully test the developed contingency plan to ensure that it would allow 
for the recovery of critical computer applications. 

Balanced against the competing demands for resources, especially in 
this budget climate, we regard it as*an acceptable risk not to expend 
at this time the funds that this testing would require. Nonetheless, we 
will continue to refine our contingency plan to reduce the potential risks 
to the campus and will also consider various aspects of the testing 
protocol with emphasis on security and cost efficiency. 

(SU) 12,13. We agree with the recommendations and the Campus responses. 



(OSC) 13. 
(SUNYA) 13. 
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